Malicious PDF — malware analysis report

Static analysis result for SHA-256 ab656fdadabeb524…

MALICIOUS

PDF

39.9 KB Authoring application: GIMP
MD5: 098381574bed35cf17b643e96a1f58ca SHA-1: 585033b2465279d61e12f25f9236d3c4ef901d25 SHA-256: ab656fdadabeb524398430712e4fd305a3d56b0dbfb334b70809d96386e6300e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded URLs pointing to other PDF documents. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, aligning with the PDF_SEO_LINK_FARM heuristic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://path.wolc.com/uploads/1/3/0/6/130640181/dulavekujekof.pdf
    • http://gonevig.audiostart07.icu/uploads/2020/01/27/sezedusa.pdf
    • http://mrpresscleaners.com/uploads/1/3/0/2/130270904/5df60126b15b.pdf
    • http://lluviaoutsourced.com/uploads/1/3/0/6/130621185/xupad_lalonu_bemaranizemo_pizefufaw.pdf
    • http://robertshafferhomebuyerscoach.com/uploads/1/3/0/6/130621125/kejabada.pdf
    • http://bilup.tenseducation.pro/uploads/2020/01/28/0cdaf27547b5.pdf
    • http://lorahakanson.com/uploads/1/3/0/2/130289519/f2ad9.pdf
    • http://hawkecreations.online/uploads/1/3/0/5/130588497/kipepilax.pdf
    • http://silor.greenwaystars.com/uploads/2020/01/28/7411226.pdf
    • http://lapar.finni.ru/uploads/2020/01/28/vubasek_tevoko_tisuzujolopupu.pdf
    • http://readersenvy.com/uploads/1/3/0/2/130271080/mewuzu-rumaxufakobijip.pdf
    • http://viw.master-grumer.ru/uploads/2020/01/28/kisupo_vaxatokaj.pdf
    • https://woluvenox.weebly.com/uploads/1/3/0/2/130271211/lawejifunigu.pdf
    • http://doverlions.org.uk/uploads/1/3/0/2/130289557/tezomasitox-komesad-jezorifi-debafip.pdf
    • http://mid.dataerudite.com/uploads/2020/01/29/bemovolubejun.pdf
    • http://amicabletrust.org/uploads/1/3/0/4/130477566/xapoliranufipudonon.pdf
    • http://parajag.donweld.ru/uploads/2020/01/28/6456303.pdf
    • http://socutepussy.com/uploads/2020/01/28/e7947dca324aa8.pdf
    • http://mrycpetcare.weebly.com/uploads/1/3/0/4/130479082/6385396.pdf
    • http://onlinehomemyaccsupport706.com/uploads/1/3/0/5/130588531/veviri.pdf
    • http://jeriziju.audiostart18.icu/uploads/2020/01/28/4362763.pdf
    • http://sodimuxive.colorsun.ru/uploads/2020/01/28/9657245.pdf
    • http://ainsleylou.com/uploads/1/3/0/6/130604602/xelanedaboni-kupufezogit-tanopujamafuxew.pdf
    • http://puzinodairy.com/uploads/1/3/0/3/130379581/kiguz.pdf
    • http://curtisconsultingnc.com/uploads/1/3/0/5/130588988/bajuzovi_zoruparabareb.pdf
    • http://thesingbabysingshow.com/uploads/1/3/0/6/130620464/130620464.html#ethnologisches+museum+berlin+stellenangebote
    • http://ainsleylou.com/uploads/1/3/0/6/130604602/xelanedaboni-kupufezogit-tanopuja

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000017a7.bin
033a7a16e207e8e647ddb13bed2fdf8886bee85170e6512b628c3f7ebc9af068		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17A7 8212 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.